Dave Chinner
837514f7a4
xfs: fix overflow in xfs_attr3_leaf_verify ...
generic/070 on 64k block size filesystems is failing with a verifier
corruption on writeback or an attribute leaf block:
[ 94.973083] XFS (pmem0): Metadata corruption detected at xfs_attr3_leaf_verify+0x246/0x260, xfs_attr3_leaf block 0x811480
[ 94.975623] XFS (pmem0): Unmount and run xfs_repair
[ 94.976720] XFS (pmem0): First 128 bytes of corrupted metadata buffer:
[ 94.978270] 000000004b2e7b45: 00 00 00 00 00 00 00 00 3b ee 00 00 00 00 00 00 ........;.......
[ 94.980268] 000000006b1db90b: 00 00 00 00 00 81 14 80 00 00 00 00 00 00 00 00 ................
[ 94.982251] 00000000433f2407: 22 7b 5c 82 2d 5c 47 4c bb 31 1c 37 fa a9 ce d6 "{\.-\GL.1.7....
[ 94.984157] 0000000010dc7dfb: 00 00 00 00 00 81 04 8a 00 0a 18 e8 dd 94 01 00 ................
[ 94.986215] 00000000d5a19229: 00 a0 dc f4 fe 98 01 68 f0 d8 07 e0 00 00 00 00 .......h........
[ 94.988171] 00000000521df36c: 0c 2d 32 e2 fe 20 01 00 0c 2d 58 65 fe 0c 01 00 .-2.. ...-Xe....
[ 94.990162] 000000008477ae06: 0c 2d 5b 66 fe 8c 01 00 0c 2d 71 35 fe 7c 01 00 .-[f.....-q5.|..
[ 94.992139] 00000000a4a6bca6: 0c 2d 72 37 fc d4 01 00 0c 2d d8 b8 f0 90 01 00 .-r7.....-......
[ 94.994789] XFS (pmem0): xfs_do_force_shutdown(0x8) called from line 1453 of file fs/xfs/xfs_buf.c. Return address = ffffffff815365f3
This is failing this check:
end = ichdr.freemap[i].base + ichdr.freemap[i].size;
if (end < ichdr.freemap[i].base)
>>>>> return __this_address;
if (end > mp->m_attr_geo->blksize)
return __this_address;
And from the buffer output above, the freemap array is:
freemap[0].base = 0x00a0
freemap[0].size = 0xdcf4 end = 0xdd94
freemap[1].base = 0xfe98
freemap[1].size = 0x0168 end = 0x10000
freemap[2].base = 0xf0d8
freemap[2].size = 0x07e0 end = 0xf8b8
These all look valid - the block size is 0x10000 and so from the
last check in the above verifier fragment we know that the end
of freemap[1] is valid. The problem is that end is declared as:
uint16_t end;
And (uint16_t)0x10000 = 0. So we have a verifier bug here, not a
corruption. Fix the verifier to use uint32_t types for the check and
hence avoid the overflow.
Fixes: https://bugzilla.kernel.org/show_bug.cgi?id=201577
Signed-off-by: Dave Chinner <[email protected] >
Reviewed-by: Darrick J. Wong <[email protected] >
Signed-off-by: Darrick J. Wong <[email protected] >
2018-11-06 07:50:50 -08:00
xfs: fix overflow in xfs_attr3_leaf_verify
2018-11-06 07:50:50 -08:00
xfs: fix buffer state management in xrep_findroot_block
2018-10-18 17:20:35 +11:00
xfs: convert to SPDX license tags
2018-06-06 14:17:53 -07:00
xfs: convert to SPDX license tags
2018-06-06 14:17:53 -07:00
xfs: move the repair extent list into its own file
2018-07-29 22:37:09 -07:00
xfs: convert to SPDX license tags
2018-06-06 14:17:53 -07:00
xfs: remove b_last_holder & associated macros
2018-08-12 08:37:31 -07:00
xfs: convert to SPDX license tags
2018-06-06 14:17:53 -07:00
xfs: convert to SPDX license tags
2018-06-06 14:17:53 -07:00
xfs: remove XFS_IO_INVALID
2018-10-18 17:17:50 +11:00
xfs: remove XFS_IO_INVALID
2018-10-18 17:17:50 +11:00
xfs: remove all boilerplate defer init/finish code
2018-07-26 10:15:15 -07:00
xfs: substitute spaces with tabs
2018-08-02 23:05:14 -07:00
xfs: pass transaction to xfs_defer_add()
2018-08-02 23:05:14 -07:00
xfs: use transaction for intent recovery instead of raw dfops
2018-08-02 23:05:13 -07:00
xfs: cancel COW blocks before swapext
2018-10-18 17:21:55 +11:00
xfs: convert to SPDX license tags
2018-06-06 14:17:53 -07:00
xfs: clear ail delwri queued bufs on unmount of shutdown fs
2018-10-18 17:21:49 +11:00
xfs: always assign buffer verifiers when one is provided
2018-10-18 17:20:30 +11:00
xfs: refactor xfs_buf_log_item reference count handling
2018-09-29 13:45:26 +10:00
xfs: refactor xfs_buf_log_item reference count handling
2018-09-29 13:45:26 +10:00
xfs: convert to SPDX license tags
2018-06-06 14:17:53 -07:00
xfs: trivial xfs_btree_del_cursor cleanups
2018-07-23 09:08:00 -07:00
xfs: remove dead error handling code in xfs_dquot_disk_alloc()
2018-08-07 10:57:13 -07:00
xfs: convert to SPDX license tags
2018-06-06 14:17:53 -07:00
xfs: convert to SPDX license tags
2018-06-06 14:17:53 -07:00
xfs: convert to SPDX license tags
2018-06-06 14:17:53 -07:00
xfs: force summary counter recalc at next mount
2018-07-23 09:08:01 -07:00
xfs: convert to SPDX license tags
2018-06-06 14:17:53 -07:00
xfs: clean up IRELE/iput callsites
2018-07-26 10:15:16 -07:00
xfs: convert to SPDX license tags
2018-06-06 14:17:53 -07:00
xfs: convert to SPDX license tags
2018-06-06 14:17:53 -07:00
xfs: convert to SPDX license tags
2018-06-06 14:17:53 -07:00
xfs: convert to SPDX license tags
2018-06-06 14:17:53 -07:00
xfs: convert to SPDX license tags
2018-06-06 14:17:53 -07:00
xfs: remove xfs_reflink_remap_range
2018-10-30 10:47:26 +11:00
xfs: replace dop_low with transaction flag
2018-08-02 23:05:13 -07:00
xfs: convert to SPDX license tags
2018-06-06 14:17:53 -07:00
xfs: trivial xfs_btree_del_cursor cleanups
2018-07-23 09:08:00 -07:00
xfs: convert to SPDX license tags
2018-06-06 14:17:53 -07:00
xfs: issue log message on user force shutdown
2018-10-18 17:20:39 +11:00
xfs: convert to SPDX license tags
2018-06-06 14:17:53 -07:00
xfs: convert to SPDX license tags
2018-06-06 14:17:53 -07:00
xfs: introduce a new xfs_inode_has_cow_data helper
2018-07-30 07:57:48 -07:00
xfs: convert to SPDX license tags
2018-06-06 14:17:53 -07:00
xfs: convert to SPDX license tags
2018-06-06 14:17:53 -07:00
xfs: convert to SPDX license tags
2018-06-06 14:17:53 -07:00
xfs: remove last of unnecessary xfs_defer_cancel() callers
2018-09-29 13:41:58 +10:00
xfs: fold dfops into the transaction
2018-08-02 23:05:14 -07:00
xfs: remove if_real_bytes
2018-07-30 07:57:48 -07:00
xfs: convert to SPDX license tags
2018-06-06 14:17:53 -07:00
xfs: Fix error code in 'xfs_ioc_getbmap()'
2018-11-06 07:50:50 -08:00
xfs: convert to SPDX license tags
2018-06-06 14:17:53 -07:00
xfs: convert to SPDX license tags
2018-06-06 14:17:53 -07:00
xfs: convert to SPDX license tags
2018-06-06 14:17:53 -07:00
xfs: remove the unused trimmed argument from xfs_reflink_trim_around_shared
2018-10-18 17:19:48 +11:00
xfs: avoid COW fork extent lookups in writeback if the fork didn't change
2018-07-31 13:18:09 -07:00
xfs: don't crash the vfs on a garbage inline symlink
2018-09-29 13:40:40 +10:00
xfs: convert to SPDX license tags
2018-06-06 14:17:53 -07:00
xfs: clean up IRELE/iput callsites
2018-07-26 10:15:16 -07:00
xfs: convert to SPDX license tags
2018-06-06 14:17:53 -07:00
xfs: replace do_mod with native operations
2018-06-08 10:07:52 -07:00
xfs: fix a comment in xfs_log_reserve
2018-08-03 08:17:54 -07:00
xfs: refactor log recovery check
2018-08-01 07:40:48 -07:00
xfs: convert to SPDX license tags
2018-06-06 14:17:53 -07:00
xfs: convert to SPDX license tags
2018-06-06 14:17:53 -07:00
xfs: remove invalid log recovery first/last cycle check
2018-09-29 13:50:41 +10:00
xfs: print buffer offsets when dumping corrupt buffers
2018-11-06 07:50:50 -08:00
xfs: recalculate summary counters at mount time if icount is bad
2018-08-13 07:58:27 -07:00
xfs: remove deprecated barrier/nobarrier mount
2018-07-26 10:15:17 -07:00
xfs: convert to SPDX license tags
2018-06-06 14:17:53 -07:00
xfs: convert to SPDX license tags
2018-06-06 14:17:53 -07:00
xfs: convert to SPDX license tags
2018-06-06 14:17:53 -07:00
xfs: prepare xfs_break_layouts() for another layout type
2018-05-22 07:19:08 -07:00
xfs: prepare xfs_break_layouts() for another layout type
2018-05-22 07:19:08 -07:00
xfs: clean up IRELE/iput callsites
2018-07-26 10:15:16 -07:00
xfs: convert to SPDX license tags
2018-06-06 14:17:53 -07:00
xfs: convert to SPDX license tags
2018-06-06 14:17:53 -07:00
xfs: clean up IRELE/iput callsites
2018-07-26 10:15:16 -07:00
xfs: convert to SPDX license tags
2018-06-06 14:17:53 -07:00
xfs: clean up IRELE/iput callsites
2018-07-26 10:15:16 -07:00
xfs: pass transaction to xfs_defer_add()
2018-08-02 23:05:14 -07:00
xfs: use transaction for intent recovery instead of raw dfops
2018-08-02 23:05:13 -07:00
vfs: rework data cloning infrastructure
2018-11-02 09:33:08 -07:00
vfs: rework data cloning infrastructure
2018-11-02 09:33:08 -07:00
xfs: convert to SPDX license tags
2018-06-06 14:17:53 -07:00
xfs: convert to SPDX license tags
2018-06-06 14:17:53 -07:00
xfs: clean up IRELE/iput callsites
2018-07-26 10:15:16 -07:00
xfs: convert to SPDX license tags
2018-06-06 14:17:53 -07:00
xfs: use offsetof() in place of offset macros for __xfsstats
2018-10-18 17:21:39 +11:00
xfs: use offsetof() in place of offset macros for __xfsstats
2018-10-18 17:21:39 +11:00
xfs: add a define for statfs magic to uapi
2018-10-18 17:20:19 +11:00
xfs: convert to SPDX license tags
2018-06-06 14:17:53 -07:00
xfs: automatic dfops inode relogging
2018-08-02 23:05:14 -07:00
xfs: convert to SPDX license tags
2018-06-06 14:17:53 -07:00
xfs: convert to SPDX license tags
2018-06-06 14:17:53 -07:00
xfs: convert to SPDX license tags
2018-06-06 14:17:53 -07:00
xfs: convert to SPDX license tags
2018-06-06 14:17:53 -07:00
xfs: convert to SPDX license tags
2018-06-06 14:17:53 -07:00
xfs: convert to SPDX license tags
2018-06-06 14:17:53 -07:00
xfs: don't unlock invalidated buf on aborted tx commit
2018-09-29 13:44:40 +10:00
xfs: avoid lockdep false positives in xfs_trans_alloc
2018-09-29 13:46:21 +10:00
xfs: fix buffer state management in xrep_findroot_block
2018-10-18 17:20:35 +11:00
xfs: clear ail delwri queued bufs on unmount of shutdown fs
2018-10-18 17:21:49 +11:00
xfs: drop dop param from xfs_defer_op_type ->finish_item() callback
2018-08-02 23:05:14 -07:00
xfs: fix buffer state management in xrep_findroot_block
2018-10-18 17:20:35 +11:00
xfs: convert to SPDX license tags
2018-06-06 14:17:53 -07:00
xfs: drop dop param from xfs_defer_op_type ->finish_item() callback
2018-08-02 23:05:14 -07:00
vfs/y2038: inode timestamps conversion to timespec64
2018-06-15 07:31:07 +09:00
xfs: convert to SPDX license tags
2018-06-06 14:17:53 -07:00
xfs: drop dop param from xfs_defer_op_type ->finish_item() callback
2018-08-02 23:05:14 -07:00
xfs: drop dop param from xfs_defer_op_type ->finish_item() callback
2018-08-02 23:05:14 -07:00
xfs: convert to SPDX license tags
2018-06-06 14:17:53 -07:00
837514f7a4